Set token with another token's value in it.

[lping]

I want to set one token value which includes another token's value "dc_no_tok".
But its not picking value of "dc_no_tok". I am not sue what I am doing wrong here?

I am passing "dc_no_tok"  from another dashboard to this dashboard and I can see that token value is getting posted in url.

e.g:

https://abc/en-US/app/search/dc2_consul_level2_errors_test?form.host_tok=consul_server&form.dc_no_tok=2 

XML:
=================

<input depends="$alwaysHide$" type="dropdown" token="host_tok" searchWhenChanged="true">
   <label />
   <change>
      <condition value="consul_client">
         <set token="Panel1">search host!=*consul* OR servername!=*consul* AND (host=pc$dc_no_tok$* OR servername=pc$dc_no_tok$* OR host=sc$dc_no_tok$* OR servername=sc$dc_no_tok$*) earliest=-5m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available") | eval ERROR=case(like(_raw, "%Push/Pull with%"), "Push/Pull Error", like(_raw, "%Failed fallback ping%"), "Failed fallback ping Error", like(_raw, "%connection reset by peer%"), "Connection reset by peer Error", like(_raw, "%keepalive timeout%"), "Keepalive Timeout Error", like(_raw, "%i/o timeout%"), "I/O Timeout Error", like(_raw, "%lead thread didn't get connection%"), "Lead thread didn't get connection Error", like(_raw, "%failed to get conn: EOF%"), "Failed to get conn: EOF Error", like(_raw, "%rpc error making call: EOF%"), "RPC error making call: EOF Error", like(_raw, "%Timeout exceeded while awaiting headers%"), "Timeout exceeded while awaiting headers Error", like(_raw, "%rpc error making call: Permission denied%"), "RPC error making call: Permission denied Error", like(_raw, "%Permission denied%"), "Permission denied Error", true(), "Other Error")| stats count by ERROR</set>
         <set token="Panel2">host!=*consul* OR servername!=*consul* AND (host=pc$$dc_no_tok$$* OR servername=pc$dc_no_tok$* OR host=sc$dc_no_tok$* OR servername=sc$dc_no_tok$*) earliest=-60m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available")| chart count by host | trendline sma5(foo) AS sm_count</set>
      </condition>
      <condition value="consul_server">
         <set token="Panel1">host=ss$dc_no_tok$consul* OR servername=ss$dc_no_tok$consul* earliest=-5m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available") | eval ERROR=case(like(_raw, "%Push/Pull with%"), "Push/Pull Error", like(_raw, "%Failed fallback ping%"), "Failed fallback ping Error", like(_raw, "%connection reset by peer%"), "Connection reset by peer Error", like(_raw, "%keepalive timeout%"), "Keepalive Timeout Error", like(_raw, "%i/o timeout%"), "I/O Timeout Error", like(_raw, "%lead thread didn't get connection%"), "Lead thread didn't get connection Error", like(_raw, "%failed to get conn: EOF%"), "Failed to get conn: EOF Error", like(_raw, "%rpc error making call: EOF%"), "RPC error making call: EOF Error", like(_raw, "%Timeout exceeded while awaiting headers%"), "Timeout exceeded while awaiting headers Error", like(_raw, "%rpc error making call: Permission denied%"), "RPC error making call: Permission denied Error", like(_raw, "%Permission denied%"), "Permission denied Error", true(), "Other Error")| stats count by ERROR</set>
         <set token="Panel2">host=ss$dc_no_tok$consul* OR servername=ss$dc_no_tok$consul* earliest=-60m sourcetype=consul_log index=hcm_consul "[ERROR]" NOT ("Newer Consul version available")| chart count by host | trendline sma5(foo) AS sm_count</set>
      </condition>
   </change>
   <choice value="consul_client">Client</choice>
   <choice value="consul_server">Server</choice>
   <default />
</input>

=================

[bowesmana]

Your token usage in your example is inside a <change> block, so unless that data is being changed, then it will not trigger the change event to set the Panel* tokens. I have in the past done something similar by using a dashboard level or hidden panel search that does something like this

| makeresults
| eval tokVal=$dc_no_tok$, tokHost=$host_tok$
| table tokVal tokHost

and then the <done> clause of the search will do

<done>
  <condition match="$result.tokHost$=&quot;consul_server&quot;>
    <set token=...></set>
  </condition>
  <condition match="$result.tokHost$=&quot;consul_client&quot;>
    <set token=...></set>
  </condition>
</done>
 

I don't know if that's the 'right' solution - but as always with Splunk there are often several 'right' ways to achieve the same outcome.

[niketn]

@lping how is dc_no_tok token being set? Can you add that code?